}

# signs a serving certificate: args are sudo, dest-dir, ca, filename (roughly), subject, hosts...
function kube::util::create_serving_certkey {
    local sudo=$1
    local dest_dir=$2
    local ca=$3
    local id=$4
    local cn=${5:-$4}
    local hosts=""
    local SEP=""
    shift 5
    while [ -n "${1:-}" ]; do
        hosts+="${SEP}\"$1\""
        SEP=","
        shift 1
    done

func getConfigsForHost(filterNamespace string, hostname host.Name, configs []config.Config) []config.Config {
	svcConfigs := make([]config.Config, 0)
	for _, cfg := range configs {
		virtualService := cfg.Spec.(*v1alpha3.VirtualService)
		for _, vsHost := range virtualService.Hosts {
			if filterNamespace != "" && filterNamespace != cfg.Namespace {
				continue
			}
			if host.Name(vsHost).Matches(hostname) {

		}
	}
	return out
}

// MostSpecificHostMatch compares the maps of specific and wildcard hosts to the needle, and returns the longest element
// matching the needle and it's value, or false if no element in the maps matches the needle.
func MostSpecificHostMatch[V any](needle host.Name, specific map[host.Name]V, wildcard map[host.Name]V) (host.Name, V, bool) {
	if needle.IsWildCarded() {
		// exact match first

platform blocks the port by default, you may need to enable access to the port. ### ufw For hosts with ufw enabled (Debian based distros), you can use `ufw` command to allow traffic to specific ports. Use below command to allow access to port 9000 ```sh ufw allow 9000 ``` Below command enables all incoming traffic to ports ranging from 9000 to 9010. ```sh ufw allow 9000:9010/tcp ``` ### firewall-cmd For hosts with firewall-cmd enabled (CentOS), you can use `firewall-cmd` command to allow traffic to...

				Crl:         file.AsStringOrFail(t, path.Join(env.IstioSrc, "tests/testdata/certs/dummy.crl")),
			}, false, apps.Ns2.Namespace.Name())

			// Set up Host Namespace
			host := apps.External.All.Config().ClusterLocalFQDN()

			testCases := []struct {
				name             string
				credentialToUse  string
				from             echo.Instances
				authorizeSidecar bool

	g := errgroup.WithNErrs(len(sys.peerClients))
	for index, client := range sys.peerClients {
		if client == nil {
			continue
		}
		host := client.host.String()
		if len(opts.hosts) > 0 {
			if _, ok := opts.hosts[host]; !ok {
				continue
			}
		}

		index := index
		g.Go(func() error {
			var err error
			reply[index], err = sys.peerClients[index].GetMetrics(ctx, t, opts)

		for _, h := range rule.Hosts {
			// TODO: This is a bug. VirtualServices can have many hosts
			// while the user might be importing only a single host
			// We need to generate a new VirtualService with just the matched host
			if servicesByName[host.Name(h)] != nil {
				match = true
				break
			}

			if host.Name(h).IsWildCarded() {
				// Process wildcard vs host as it need to follow the slow path of

const (
	dotdotComponent = ".."
	dotComponent    = "."
)

func hasBadHost(host string) error {
	if globalIsCICD && strings.TrimSpace(host) == "" {
		// under CI/CD test setups ignore empty hosts as invalid hosts
		return nil
	}
	_, err := xnet.ParseHost(host)
	return err
}

// Check if the incoming path has bad path components,
// such as ".." and "."

		return fmt.Errorf("%v is not a valid IP", addr)
	}

	return nil
}

func ValidatePartialWildCard(host string) error {
	if strings.Contains(host, "*") && len(host) != 1 && !strings.HasPrefix(host, "*.") {
		return fmt.Errorf("partial wildcard %q not allowed", host)
	}
	return nil
}

// validates that hostname in ns/<hostname> is a valid hostname according to
// API specs

  // matches only a single label. You cannot have a wildcard label by itself (e.g. Host == "*").
  // Requests will be matched against the Host field in the following way:
  // 1. If Host is precise, the request matches this rule if the http host header is equal to Host.
  // 2. If Host is a wildcard, then the request matches this rule if the http host header
  // is to equal to the suffix (removing the first label) of the wildcard rule.